Vulnerabilidades de SourceCodester
CVEs publicadas que afetam produtos de SourceCodester: 508 registro(s), com severidade, exploração e correções.
Class and Exam Timetabling System 59Pharmacy Sales and Inventory System 30Pizzafy Ecommerce System 27Sales and Inventory System 21Drug Recommendation System 17Online Reviewer Management System 15Hotel and Lodge Management System 15Pet Grooming Management Software 14Patients Waiting Area Queue Management System 13Simple Online Food Ordering System 13Hospitals Patient Records Management System 8CET Automated Grading System with AI Predictive Analytics 8Inventory Management System 8Student Grades Management System 7Syllabus-Aligned Learning Management & Examination System 7Onlne Examination & Learning Management System 7Simple Doctors Appointment System 6Performance Indicator System 6Simple and Nice Shopping Cart Script 6Best House Rental Management System 6Multi-Vendor Online Grocery Management System 6Photo Share Website 5SUP Online Shopping 5Online Food Ordering System 5Student Result Management System 5Client Database Management System 5Online Book Store System 5Farm Management System 5Online Voting System 5Web-based Pharmacy Product Management System 4Indian Invoicing System 4Simple Responsive Tourism Website 4Simple POS and Inventory System 4Resort Reservation System 4Best Salon Management System 4School Registration and Fee System 4Online Faculty Clearance System 4Train Station Ticketing System 4Food Ordering System 3Leave Application System 3
CVE-2026-2983
Crítica · 9.8
CWE-266 23/02/2026
SourceCodester Student Result Management System Bulk Import import_users.php access control
A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the file /admin/core/import_users.php of the component Bulk Import. This manipulation of the argument File causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVE-2026-2938
Alta · 7.3
CWE-266 22/02/2026
SourceCodester Student Result Management System update_smtp.php access control
A vulnerability has been found in SourceCodester Student Result Management System 1.0. The affected element is an unknown function of the file /srms/script/admin/core/update_smtp.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-2848
Crítica · 9.8
CWE-89 20/02/2026
SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection
A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
CVE-2026-2177
Alta · 7.3
CWE-384 08/02/2026
SourceCodester Prison Management System Login session fixiation
A vulnerability has been found in SourceCodester Prison Management System 1.0. The impacted element is an unknown function of the component Login. The manipulation leads to session fixiation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-2160
Média · 6.1
CWE-79 08/02/2026
SourceCodester Simple Responsive Tourism Website Master.php cross site scripting
A vulnerability has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Master.php?f=save_package. The manipulation of the argument Title leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-2159
Média · 6.1
CWE-79 08/02/2026
SourceCodester Simple Responsive Tourism Website Registration Master.php cross site scripting
A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected is an unknown function of the file /tourism/classes/Master.php?f=register of the component Registration. Executing a manipulation of the argument firstname/lastname/username can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVE-2026-2154
Média · 6.1
CWE-79 08/02/2026
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System Patient Registration registration.php cross site scripting
A vulnerability was identified in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Impacted is an unknown function of the file /registration.php of the component Patient Registration Module. The manipulation of the argument First Name leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVE-2026-2150
Média · 6.1
CWE-79 08/02/2026
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System checkin.php cross site scripting
A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functionality of the file /checkin.php. This manipulation of the argument patient_id causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.
CVE-2026-2149
Média · 6.1
CWE-79 08/02/2026
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System appointments.php cross site scripting
A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /appointments.php. The manipulation of the argument patient_id results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVE-2026-2090
Crítica · 9.8
CWE-74 07/02/2026
Injeção de SQL no SourceCodester Online Class Record System (CVE-2026-2090)
Foi identificada uma vulnerabilidade no SourceCodester Online Class Record System 1.0. Este problema afeta um processamento desconhecido do arquivo /admin/message/search.php. A manipulação do argumento term pode levar a injeção de SQL. O ataque pode ser executado remotamente. A exploração foi divulgada publicamente e pode ser utilizada.
CVE-2026-2089
Crítica · 9.8
CWE-74 07/02/2026
SourceCodester Online Class Record System controller.php sql injection
A vulnerability was found in SourceCodester Online Class Record System 1.0. This vulnerability affects unknown code of the file /admin/subject/controller.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVE-2026-2087
Crítica · 9.8
CWE-74 07/02/2026
Injeção de SQL no login administrativo do Online Class Record System 1.0
Foi identificada uma falha no SourceCodester Online Class Record System 1.0. Afeta algumas funcionalidades desconhecidas do arquivo /admin/login.php. A manipulação do argumento user_email causa injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi publicado e pode ser utilizado.
CVE-2026-2059
Crítica · 9.8
CWE-89 06/02/2026
Injeção de SQL no Medical Center Portal Management System da SourceCodester via emp_edit1.php (CVE-2026-2059)
Foi identificada uma vulnerabilidade no SourceCodester Medical Center Portal Management System 1.0. Uma função desconhecida do arquivo /emp_edit1.php é afetada. A manipulação do argumento ID leva a injeção de SQL. O ataque pode ser realizado remotamente. O exploit foi divulgado publicamente e pode ser utilizado.
CVE-2026-2057
Crítica · 9.8
CWE-89 06/02/2026
SQL Injection no login do Medical Center Portal Management System 1.0 (SourceCodester)
Foi detectada uma vulnerabilidade no SourceCodester Medical Center Portal Management System 1.0. Ela afeta uma função não identificada do arquivo /login.php. A manipulação do argumento User resulta em injeção de SQL. O ataque pode ser executado remotamente. O exploit agora é público e pode ser utilizado.
CVE-2026-2009
Média · 6.5
CWE-266 06/02/2026
SourceCodester Gas Agency Management System createUser.php access control
A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/php_action/createUser.php. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVE-2026-1745
Média · 4.3
CWE-352 02/02/2026
SourceCodester Medical Certificate Generator App cross-site request forgery
A vulnerability was determined in SourceCodester Medical Certificate Generator App 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVE-2026-1702
Alta · 8.8
CWE-266 30/01/2026
SourceCodester Pet Grooming Management Software User Management user.php improper authorization
A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/operation/user.php of the component User Management. Performing a manipulation of the argument group_id results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be used.
CVE-2026-1154
Média · 5.4
CWE-74 19/01/2026
SourceCodester E-Learning System Lesson index.php cross site scripting
A flaw has been found in SourceCodester E-Learning System 1.0. This impacts an unknown function of the file /admin/modules/lesson/index.php of the component Lesson Module Handler. Executing a manipulation of the argument Title/Description can lead to basic cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.
CVE-2026-1148
Média · 6.5
CWE-352 19/01/2026
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System cross-site request forgery
A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This vulnerability affects unknown code. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely.
CVE-2026-1147
Média · 5.4
CWE-79 19/01/2026
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_patient_schedule.php cross site scripting
A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api_patient_schedule.php. Performing a manipulation of the argument Reason results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
CVE-2026-1146
Média · 5.4
CWE-79 19/01/2026
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_register_patient.php cross site scripting
A vulnerability has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functionality of the file /php/api_register_patient.php. Such manipulation of the argument firstName/lastName leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
CVE-2026-0580
Média · 6.1
CWE-79 05/01/2026
SourceCodester API Key Manager App Import Key cross site scripting
A vulnerability was found in SourceCodester API Key Manager App 1.0. Affected by this vulnerability is an unknown functionality of the component Import Key Handler. Performing a manipulation results in cross site scripting. The attack can be initiated remotely.
CVE-2025-14885
Alta · 8.8
CWE-284 18/12/2025
SourceCodester Client Database Management System Leads Generation user_leads.php unrestricted upload
A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads Generation Module. Executing manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
CVE-2025-14530
Alta · 7.2
CWE-434 11/12/2025
SourceCodester Real Estate Property Listing App property.php unrestricted upload
A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property.php. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-14229
Alta · 8.0
CWE-1236 08/12/2025
SourceCodester Inventory Management System SVC Report Export csv injection
A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to csv injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.